diff --git a/neps/nep-0488.md b/neps/nep-0488.md index 70981daf7..768b75d66 100644 --- a/neps/nep-0488.md +++ b/neps/nep-0488.md @@ -79,15 +79,15 @@ to ensure future ease in supporting corresponding precompiles for Aurora[^24]. elements $\textbraceleft 0, 1, \ldots, p - 1 \textbraceright$ with two operations: multiplication $\cdot$ and addition $+$. These operations involve standard integer multiplication and addition, -followed by taking the remainder modulo $p$. +followed by computing the remainder modulo $p$. -**The elliptic curve $E(F_p)$** is a set of all pairs $(x, y) \in F_p$: +**The elliptic curve $E(F_p)$** is the set of all pairs $(x, y)$ with coordinates in $F_p$ satisfying: $$ y^2 \equiv x^3 + Ax + B \mod p $$ -together with an imaginary point at infinity 0, where: $A, B \in F_p$, p is prime > 3, and $4A^3 + 27B^2 \not \equiv 0 \mod p$ +together with an imaginary point at infinity $\mathcal{O}$, where: $A, B \in F_p$, p is prime > 3, and $4A^3 + 27B^2 \not \equiv 0 \mod p$ In the case of BLS12-381 equation is $y^2 \equiv x^3 + 4 \mod p$[^15],[^51],[^14],[^11] @@ -95,22 +95,22 @@ In the case of BLS12-381 equation is $y^2 \equiv x^3 + 4 \mod p$[^15],[^51],[^14 - $A = 0$ - $B = 4$ -- $p = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab$ +- $p = \mathtt{0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab}$ -Let’s $P \in E(F_q)$ have coordinates (x, y), define **$-P$** as a point on a curve with coordinates (x, -y). +Let $P \in E(F_q)$ have coordinates (x, y), define **$-P$** as a point on a curve with coordinates (x, -y). -**The addition operation for Elliptic Curve** is a function $+\colon E(F_p) \times E(F_p) \rightarrow E(F_p)$ defined with following rules: let’s P and Q $\in E(F_p)$ +**The addition operation for Elliptic Curve** is a function $+\colon E(F_p) \times E(F_p) \rightarrow E(F_p)$ defined with following rules: let P and Q $\in E(F_p)$ - if $P \ne Q$ and $P \ne -Q$ - draw a line passing through P and Q. This line intersects the curve at a third point R - - reflect the point R about the x-axis by changing the sign of the y-coordinate. The resulting point is P+Q. + - reflect the point R across the x-axis by changing the sign of the y-coordinate. The resulting point is P+Q. - if $P=Q$ - draw a tangent line throw P for an elliptic curve. The line will intersect the curve at the second point R. - - reflect the point R about the x-axis the same way to get point 2P + - reflect the point R across the x-axis the same way to get point 2P - $P = -Q$ - - $P + Q = P + (-P) = 0$ — the point on infinity -- Q = 0 - - $P + Q = P + 0 = P$ + - $P + Q = P + (-P) = \mathcal{O}$ — the point on infinity +- $Q = \mathcal{O}$ + - $P + Q = P + \mathcal{O} = P$ With the addition operation, Elliptic Curve forms a **group**. @@ -128,21 +128,21 @@ Group/subgroup **order** is the number of elements in group/subgroup. Notation: |G| or #G, where G represents the group. -For some technical reason (for `pairing` operation which we will define later), -we will operate not with the entire $E(F_p)$, -but only with the two subgroups $G_1$ and $G_2$ +For some technical reason (related to the `pairing` operation which we will define later), +we will not operate over the entire $E(F_p)$, +but only over the two subgroups $G_1$ and $G_2$ having the same **order** $r$. $G_1$ is a subset of $E(F_p)$, while $G_2$ is a subgroup of another group that we will define later. -The value of $r$ should be a prime number, and $G1 \ne G2$ +The value of $r$ should be a prime number and $G_1 \ne G_2$ -For our BLS12-381 Elliptic Curve, **the order r** of $G1$ and $G2$[^15],[^51] is given by: +For the BLS12-381 Elliptic Curve, **the order r** of $G_1$ and $G_2$[^15],[^51] is given by: -- $r = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001$ +- $r = \mathtt{0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001}$ #### Field extension -**The field extension $F_{p^k}$** is a set comprising all polynomials with a degree < k and coefficients from $F_p$, along with defined operations of multiplication ($\cdot$) and addition ($+$). +**The field extension $F_{p^k}$ of $F_{p}$** is a set comprising all polynomials of degree < k and coefficients from $F_p$, along with defined operations of multiplication ($\cdot$) and addition ($+$). $$ a_{k - 1}x^{k - 1} + \ldots + a_1x + a_0 = A(x) \in F_{p^k} \vert a_i \in F_p @@ -177,7 +177,7 @@ We'll construct this field not directly as an extension from $F_p$, but rather through a stepwise process. First, we'll build $F_{p^2}$ as a quadratic extension of the field $F_p$. Second, we'll establish $F_{p^6}$ as a cubic extension of $F_{p^2}$. -Finally, we'll create $F_{p^{12}}$, a quadratic extension of the +Finally, we'll create $F_{p^{12}}$ as a quadratic extension of the field $F_{p^6}$. To define these fields, we'll need to set up three irreducible polynomials[^51]: @@ -186,7 +186,7 @@ To define these fields, we'll need to set up three irreducible polynomials[^51]: - $F_{p^6} = F_{p^2}[v] / (v^3 - u - 1)$ - $F_{p^{12}} = F_{p^6}[w] / (w^2 - v)$ -The second subgroup we'll utilize has an order of r and +The second subgroup we'll utilize has order r and resides within the same elliptic curve but with elements from $F_{p^{12}}$. Specifically, $G_2 \subset E(F_{p^{12}})$, where $E: y^2 = x^3 + 4$ @@ -214,14 +214,14 @@ In most cases, we will be working with points from $G_2' \subset E'(F_{p^2})$ an #### Generators -If there exists an element g in the group G such that $\textbraceleft g, 2g, 3g, \ldots, |G|g \textbraceright = G$, the group G is called a ***cyclic group*** and g is termed a ***generator*** +If there exists an element $g$ in the group $G$ such that $\textbraceleft g, 2 \cdot g, 3 \cdot g, \ldots, |G|g \textbraceright = G$, the group $G$ is called a ***cyclic group*** and $g$ is termed a ***generator*** $G_1$ and $G_2$ are cyclic subgroups with the following generators[^15],[^51]: $G_1$: -- $x = 0x17f1d3a73197d7942695638c4fa9ac0fc3688c4f9774b905a14e3a3f171bac586c55e83ff97a1aeffb3af00adb22c6bb$ -- $y = 0x08b3f481e3aaa0f1a09e30ed741d8ae4fcf5e095d5d00af600db18cb2c04b3edd03cc744a2888ae40caa232946c5e7e1$ +- $x = \mathtt{0x17f1d3a73197d7942695638c4fa9ac0fc3688c4f9774b905a14e3a3f171bac586c55e83ff97a1aeffb3af00adb22c6bb}$ +- $y = \mathtt{0x08b3f481e3aaa0f1a09e30ed741d8ae4fcf5e095d5d00af600db18cb2c04b3edd03cc744a2888ae40caa232946c5e7e1}$ For $(x', y') \in G_2 \subset E'(F_{p^2}):$ $$x' = x_0 + x_1u$$ @@ -230,13 +230,13 @@ $$y' = y_0 + y_1u$$ $G_2$: -- $x_0 = 0x024aa2b2f08f0a91260805272dc51051c6e47ad4fa403b02b4510b647ae3d1770bac0326a805bbefd48056c8c121bdb8$ -- $x_1 = 0x13e02b6052719f607dacd3a088274f65596bd0d09920b61ab5da61bbdc7f5049334cf11213945d57e5ac7d055d042b7e$ -- $y_0 = 0x0ce5d527727d6e118cc9cdc6da2e351aadfd9baa8cbdd3a76d429a695160d12c923ac9cc3baca289e193548608b82801$ -- $y_1 = 0x0606c4a02ea734cc32acd2b02bc28b99cb3e287e85a763af267492ab572e99ab3f370d275cec1da1aaa9075ff05f79be$ +- $x_0 = \mathtt{0x024aa2b2f08f0a91260805272dc51051c6e47ad4fa403b02b4510b647ae3d1770bac0326a805bbefd48056c8c121bdb8}$ +- $x_1 = \mathtt{0x13e02b6052719f607dacd3a088274f65596bd0d09920b61ab5da61bbdc7f5049334cf11213945d57e5ac7d055d042b7e}$ +- $y_0 = \mathtt{0x0ce5d527727d6e118cc9cdc6da2e351aadfd9baa8cbdd3a76d429a695160d12c923ac9cc3baca289e193548608b82801}$ +- $y_1 = \mathtt{0x0606c4a02ea734cc32acd2b02bc28b99cb3e287e85a763af267492ab572e99ab3f370d275cec1da1aaa9075ff05f79be}$ -**Cofactor** is the ratio of the size of the entire group G to the size of the subgroup H: +**Cofactor** is the ratio of the size of the entire group $G$ to the size of the subgroup $H$: $$ |G|/|H| @@ -244,30 +244,30 @@ $$ Cofactor $G_1\colon h = |E(F_p)|/r$[^51] -$$h = 0x396c8c005555e1568c00aaab0000aaab$$ +$$h = \mathtt{0x396c8c005555e1568c00aaab0000aaab}$$ Cofactor $G_2\colon h' = |E'(F_{p^2})|/r$[^51] -$$h' = 0x5d543a95414e7f1091d50792876a202cd91de4547085abaa68a205b2e5a7ddfa628f1cb4d9e82ef21537e293a6691ae1616ec6e786f0c70cf1c38e31c7238e5$$ +$$h' = \mathtt{0x5d543a95414e7f1091d50792876a202cd91de4547085abaa68a205b2e5a7ddfa628f1cb4d9e82ef21537e293a6691ae1616ec6e786f0c70cf1c38e31c7238e5}$$ #### Pairing -Pairing is an operation necessary for digital signatures and zkSNARKs verification. It performs the operation $e\colon G_1 \times G_2 \rightarrow G_T$, where $G_T \subset F_{p^{12}}$. +Pairing is a necessary operation for the verification of BLS signatures and certain zkSNARKs. It performs the operation $e\colon G_1 \times G_2 \rightarrow G_T$, where $G_T \subset F_{p^{12}}$. The main properties of the pairing operation are: - $e(P, Q + R) = e(P, Q) \cdot e(P, R)$ - $e(P + S, R) = e(P, R)\cdot e(S, R)$ -To compute this function, we utilize an algorithm called Miller Loop. -For effective implementation of this algorithm, +To compute this function, we utilize an algorithm called Miller Loop. +For an affective implementation of this algorithm, we require a key parameter for the BLS curve, denoted as $x$: -$$ x = -0xd201000000010000$$ +$$ x = -\mathtt{0xd201000000010000}$$ This parameter can be found in the following sources: -- [^15] section specification, pairing parameters, miller loop scalar +- [^15] section specification, pairing parameters, Miller loop scalar - [^51] section 4.2.1 Parameter t - [^14] section BLS12-381, parameter u - [^11] section Curve equation and parameters, parameter x @@ -276,7 +276,7 @@ This parameter can be found in the following sources: The parameters for the BLS12-381 curve are as follows: -Base field modulus: $p = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab$ +Base field modulus: $p = \mathtt{0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab}$ $$ E\colon y^2 \equiv x^3 + 4 @@ -286,7 +286,7 @@ $$ E'\colon y^2 \equiv x^3 + 4(u + 1) $$ -Main subgroup order: $r = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001$ +Main subgroup order: $r = \mathtt{0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001}$ $$ F_{p^2} = F_p[u] / (u^2 + 1) @@ -300,27 +300,27 @@ $$ F_{p^{12}} = F_{p^6}[w] / (w^2 - v) $$ -Generator for G1: +Generator for $G_1$: -- $x = 0x17f1d3a73197d7942695638c4fa9ac0fc3688c4f9774b905a14e3a3f171bac586c55e83ff97a1aeffb3af00adb22c6bb$ -- $y = 0x08b3f481e3aaa0f1a09e30ed741d8ae4fcf5e095d5d00af600db18cb2c04b3edd03cc744a2888ae40caa232946c5e7e1$ +- $x = \mathtt{0x17f1d3a73197d7942695638c4fa9ac0fc3688c4f9774b905a14e3a3f171bac586c55e83ff97a1aeffb3af00adb22c6bb}$ +- $y = \mathtt{0x08b3f481e3aaa0f1a09e30ed741d8ae4fcf5e095d5d00af600db18cb2c04b3edd03cc744a2888ae40caa232946c5e7e1}$ -Generator for G2: +Generator for $G_2$: -- $x_0 = 0x024aa2b2f08f0a91260805272dc51051c6e47ad4fa403b02b4510b647ae3d1770bac0326a805bbefd48056c8c121bdb8$ -- $x_1 = 0x13e02b6052719f607dacd3a088274f65596bd0d09920b61ab5da61bbdc7f5049334cf11213945d57e5ac7d055d042b7e$ -- $y_0 = 0x0ce5d527727d6e118cc9cdc6da2e351aadfd9baa8cbdd3a76d429a695160d12c923ac9cc3baca289e193548608b82801$ -- $y_1 = 0x0606c4a02ea734cc32acd2b02bc28b99cb3e287e85a763af267492ab572e99ab3f370d275cec1da1aaa9075ff05f79be$ +- $x_0 = \mathtt{0x024aa2b2f08f0a91260805272dc51051c6e47ad4fa403b02b4510b647ae3d1770bac0326a805bbefd48056c8c121bdb8}$ +- $x_1 = \mathtt{0x13e02b6052719f607dacd3a088274f65596bd0d09920b61ab5da61bbdc7f5049334cf11213945d57e5ac7d055d042b7e}$ +- $y_0 = \mathtt{0x0ce5d527727d6e118cc9cdc6da2e351aadfd9baa8cbdd3a76d429a695160d12c923ac9cc3baca289e193548608b82801}$ +- $y_1 = \mathtt{0x0606c4a02ea734cc32acd2b02bc28b99cb3e287e85a763af267492ab572e99ab3f370d275cec1da1aaa9075ff05f79be}$ -Cofactor for G1: -$$h = 0x396c8c005555e1568c00aaab0000aaab$$ +Cofactor for $G_1$: +$$h = \mathtt{0x396c8c005555e1568c00aaab0000aaab}$$ -Cofactor for G2: -$$h' = 0x5d543a95414e7f1091d50792876a202cd91de4547085abaa68a205b2e5a7ddfa628f1cb4d9e82ef21537e293a6691ae1616ec6e786f0c70cf1c38e31c7238e5$$ +Cofactor for $G_2$: +$$h' = \mathtt{0x5d543a95414e7f1091d50792876a202cd91de4547085abaa68a205b2e5a7ddfa628f1cb4d9e82ef21537e293a6691ae1616ec6e786f0c70cf1c38e31c7238e5}$$ Key BLS12-381 parameter used in Miller Loop: -$$x = -0xd201000000010000$$ +$$x = -\mathtt{0xd201000000010000}$$ All parameters were sourced from [^15], [^51], and [^14], and they remain consistent across these sources. @@ -329,10 +329,10 @@ All parameters were sourced from [^15], [^51], and [^14], and they remain consis This section delineates the functionality of the `bls12381_map_fp_to_g1` and `bls12381_map_fp2_to_g2` functions, operating in accordance with the RFC9380 specification "Hashing to Elliptic Curves"[^62]. -These functions map the field elements in $F_p$ or $F_{p^2}$ +These functions map field elements in $F_p$ or $F_{p^2}$ to their corresponding subgroups: $G_1 \subset E(F_p)$ or $G_2 \subset E'(F_{p^2})$. `bls12381_map_fp_to_g1`/`bls12381_map_fp2_to_g2` combine the functionalities -of map_to_curve and clear_cofactor from RFC9380[^63]. +of `map_to_curve` and `clear_cofactor` from RFC9380[^63]. ```text fn bls12381_map_fp_to_g1(u): @@ -340,10 +340,10 @@ fn bls12381_map_fp_to_g1(u): return clear_cofactor(Q); ``` -We choose not to implement the hash_to_field function as a host function due to potential changes in hashing methods. +We choose not to implement the `hash_to_field` function as a host function due to potential changes in hashing methods. Additionally, executing this function within the contract consumes approximately 2 TGas, which is acceptable for our goals. -Specific implementation parameters for bls12381_map_fp_to_g1 and bls12381_map_fp2_to_g2 can be found in RFC9380 +Specific implementation parameters for `bls12381_map_fp_to_g1` and `bls12381_map_fp2_to_g2` can be found in RFC9380 under sections 8.8.1[^64] and 8.8.2[^65], respectively. ### Curve points encoding @@ -532,9 +532,9 @@ This section aims to verify the correctness of summing two valid elements on the Edge cases: - Points not from G1. -- 0 + 0 = 0. -- P + 0 = 0 + P = P. -- P + (-P) = (-P) + P = 0. +- $\mathcal{O} + \mathcal{O} = \mathcal{O}$. +- $P + \mathcal{O} = \mathcal{O} + P = P$. +- $P + (-P) = (-P) + P = \mathcal{O}$. - P + P (tangent to the curve). - The sum of two points P and (-(P + P)) (tangent to the curve at point P). @@ -543,7 +543,7 @@ Edge cases: This section aims to validate the correctness of point inversion: -- Generate random points on the curve and verify P - P = -P + P = 0. +- Generate random points on the curve and verify $P - P = -P + P = \mathcal{O}$. - Generate random points on the curve and verify -(-P) = P. - Generate random points from G1 and ensure that -P also belong to G1. - Utilize an external implementation, generate random points on the curve, and compare results. @@ -551,7 +551,7 @@ This section aims to validate the correctness of point inversion: Edge cases: - Point not from G1 -- -0 +- -$\mathcal{O}$ Tests for incorrect data @@ -926,9 +926,9 @@ For an empty input, the function returns ERROR_CODE = 0. Tests for one pair -- Generate a random point $P \in G_1$: verify $e(P, 0) = 1$ -- Generate a random point $Q \in G_2$: verify $e(0, Q) = 1$ -- Generate random points $P \ne 0 \in G_1$ and $Q \ne 0 \in G_2$: verify $e(P, Q) \ne 1$ +- Generate a random point $P \in G_1$: verify $e(P, \mathcal{O}) = 1$ +- Generate a random point $Q \in G_2$: verify $e(\mathcal{O}, Q) = 1$ +- Generate random points $P \ne \mathcal{O} \in G_1$ and $Q \ne \mathcal{O} \in G_2$: verify $e(P, Q) \ne 1$ Tests for two pairs